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I. Real Party in Interest 
The assignee of the present invention is Hewlett-Packard Development Company, 

L.P. 
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II. Related Appeals and Interferences 
There are no related appeals or interferences known to the Appellant. 
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III. Status of Claims 
Claims 1-20 are rejected. This Appeal involves Claims 1-20. 
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IV. Status of Amendments 
All proposed amendments have been entered. An amendment subsequent to the 
Final Action has not been filed. 
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V. Summary of Claimed Subject Matter 
Independent Claims 1,10, and 15 of the present application pertain to embodiments 
associated with methods and systems for a security indication spanning tree method. 

As recited in Claim 1, a "security indication spanning tree method" is disclosed. One 
embodiment is depicted at least in Figure 1 . As described in the instant disclosure at least on 
page 8, lines 9-21, and Figure 1, one method includes 110 determining the asset value of a 
network node. The instant disclosure further includes on at least page 8, lines 23-29, and 
page 9, lines 1-3, and 120 of Figure 1, ascertaining an exposure rating of the network node. 
Furthermore, the instant disclosure includes on at least page 9, lines 5-14, and Figure 1, 
establishing 130 a functional priority risk indicator for indicating the likelihood of an attack 
from another network node. The instant disclosure further includes on at least page 9, lines 
16-21, and Figure 1, creating a spanning tree schematic of a network including the network 
node as shown at 140, wherein the spanning tree schematic includes an indication of the asset 
value. 

As recited in Claim 10, a "security indication spanning tree system" is disclosed. One 
embodiment is depicted at least in Figure 3. As described in the instant disclosure on page 
14, lines 19-22, one embodiment includes bus 357 of Figure 3 for communicating 
information. The instant disclosure further includes on page 14, lines 22-24, a processor 351 
of Figure 3 coupled to bus 357, the processor 351 for processing the information including 
instructions for building an attack impact susceptibility spanning tree representation 
including asset value factors. Furthermore, the instant disclosure includes on page 14, line 
29, and page 15, lines 1-2, a memory 352 of Figure 3 coupled to bus 357, the memory 352 for 
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storing the information, including instructions for building the attack impact susceptibility 
spanning tree representation including the asset value factors. 

As recited in Claim 15, "[a] computer usable storage medium having computer 
readable program code embodied therein for causing a computer system to implement 
security indication spanning tree instructions" is disclosed. One embodiment is depicted at 
least in Figure 4. As described in the instant disclosure on page 15, lines 24-29, one 
embodiment includes a device examination module 411 of Figure 4 for examining 
information regarding devices included in a centralized resource network, wherein the 
examining includes ascertaining what applications the devices support. The instant 
disclosure further includes on page 16, lines 1-5, an importance indication module 412 of 
Figure 4 for obtaining an indication of a relative importance of functionality provided by the 
device. Furthermore, the instant disclosure includes on page 16, lines 20-25, a spanning tree 
module 415 of Figure 4 for building a spanning tree topology representation including the 
indication of the relative importance of the device in supporting the applications. 
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VI. Grounds of Rejection to Be Reviewed on Appeal 



1. Claims 1-16, 19, and 20 are rejected under 35 U.S.C. § 102(e) as being anticipated by 
Fox et al. (U.S. Patent No. 6,535,227) (hereinafter referred to as "Fox"). 

2. Claims 17 and 18 are rejected under 35 U.S.C. §103(a) as being unpatentable over 
Fox in view of Burrows et al. (U.S. Patent Publication No. 2002/0073338) (hereinafter 
referred to as "Burrows"). 
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VII. Argument 

1. Whether Claims 1-16, 19, and 20 are rejected under 35 U.S.C. § 102(e) as being 
anticipated by Fox . 

Appellant respectfully submits that embodiments of the present invention as recited in 
Claims 1-16, 19, and 20 are not anticipated by Fox, in view of the following rationale. 

Appellant respectfully points out that independent Claim 1 (Independent Claims 10 
and 15 include similar features) recites "a security indication spanning tree method 
comprising: 

determining asset value of a network node; 

ascertaining exposure rating of said network node; 
establishing a functional priority risk indicator for indicating the likelihood of an attack from 
another network node; and 

creating a spanning tree schematic of a network including said network node, wherein 
said spanning tree schematic includes an indication of said asset value (emphasis added). 



Appellant respectfully notes that "[a] claim is anticipated only if each and every 
element as set forth in the claim is found, either expressly or inherently described, in a single 
prior art reference". MPEP §2131; Verdegaal Bros. v. Union Oil Co. of California, 814 F.2d 
628, 631, 2 USPQ2d 1051, 103 (Fed. Cir. 1987). 

The instant Office Action states that "Fox teaches everything with respect to claim 1, 
a security indication spanning tree method comprising: determining asset value of a network 
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node (see abstract and column 3 lines 34-59);. . .and creating a spanning tree schematic of a 
network including said network node, wherein said spanning tree schematic includes an 
indication of said asset value (see abstract and figure 7, 9, and 10)." (Emphasis added; Office 
Action mailed on December 10, 2007, Pages 2-3.) 

Appellant respectfully submits that Fox does not anticipate "determining asset value 
of a network node" (emphasis added), or "said spanning tree schematic includes an indication 
of said asset value " (emphasis added) as recited in Appellant's Claim 1. Appellant 
understands Fox to disclose a method of using a graphical user interface on a computer 
screen "for determining the vulnerability posture of a network." (Emphasis added; Fox, 
ABSTRACT.) Further, lines 26-33 of Fox's ABSTRACT disclose the following: "The 
respective network icons are linked together in an arrangement corresponding to how 
network elements are interconnected within the network. Selected portions of the network 
map turn a different color indicative of a vulnerability that has been established for that 
portion of the network after vulnerability posture of the network has been established 
(emphasis added)." 

Whereas Fox discloses a portion of a network map turning a different color indicative 
of a vulnerability . Appellant's Claim 1 discloses determining an asset value , and creating a 
spanning tree schematic including an indication of the asset value . 

"Claims are not to be read in a vacuum, and limitations therein are to be interpreted in 
light of the specification in giving them their 'broadest reasonable interpretation'." 710 F.2d 
at 802, 218 USPQ at 292 (quoting In re Okuzawa , 537 F. 2d 545, 548, 190 USPQ 464, 466 
(CCPA [1976]) (emphasis in original); MPEP 21 1 1.02, II). "[T]he ordinary and customary 
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meaning of a claim term is the meaning that the term would have to a person of ordinary skill 
in the art in question at the time of the invention, i.e., as of the effective filing date of the 
patent application." Phillips v. AWH Corp. , 415 F.3d 1303, 1313, 72 USPQ2d 1321, 1326 
(Fed. Cir. 2005) (en banc). Sunrace Roots Enter. Co. v. SRAM Corp. , 336 F.3d 1298, 1302, 
67 USPQ2d 1438, 1441 (Fed. Cir. 2003); Brookhill-Wilk 1, LLC v. Intuitive Surgical Inc. . 
334 F.3d 1294, 1298 67 USPQ2d 1 132, 1 136 (Fed. Cir. 2003) ("In the absence of an express 
intent to impart a novel meaning to the claim terms, the words are presumed to take on the 
ordinary and customary meanings attributed to them by those of ordinary skill in the art.") 

Appellant respectfully submits that Fox's "vulnerability" is not the same as 
Appellant's "asset value" as recited in Appellant's Claim 1 . Fox's Background of the 
Invention section defines 'vulnerability' as ". . .any situation that could cause loss of one of 
those three qualities ['qualities' refers to secrecy, integrity, and availability (Fox, column 1, 
lines 37-44)]" (Fox, column 1, lines 42-44). 

In contrast, the ordinary and customary meanings attributed to the term 'asset value' 
of Applicant's Claim 1 is not the same as Fox's 'vulnerability'. Moreover, as stated herein, 
limitations within Claims are to be read in light of the specification, and are to be given their 
broadest meaning. Appellant's specification describes one embodiment of the term 'asset 
value' as providing an indication of the economic value or utility of the functions provided 
by the network node. Application, page 8, lines 9-21. The term 'asset value' should be read 
in light of the specification, which defines 'asset value' as the network node's economic 
value or utility. Given the context of the specification explanation and definition, and even 
considering its broadest meaning, the term 'indication of said asset value' does not equate to 
identifying a vulnerability and indicating its level with different color indicators . In other 
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words, Fox's vulnerability color indication is not the same as the economic asset value 
indication of Appellant's Claim 1 . Furthermore, Appellant respectfully submits that Fox 
remains silent as to any indication of an asset's value. 

Therefore, Appellant respectfully submits that Fox does not anticipate "determining 
asset value of a network node" (emphasis added), or "said spanning tree schematic includes 
an indication of said asset value " (emphasis added) as is recited in Appellant's Claim 1. 

Therefore, Appellant respectfully submits that Fox does not anticipate the features as 
are set forth in independent Claim 1, and as such, Claim 1 traverses the instant Office 
Action's basis for rejection under 35 U.S.C. § 102(e) and is in condition for allowance. 
Accordingly, Appellant also respectfully submits that Fox does not anticipate the similar 
features of independent Claims 10 and 15 for reasons stated herein regarding Claim 1 . 
Furthermore, Appellant respectfully submits that Claims 2-9 dependent on Claim 1, 11-14 
dependent on Claim 10, and 16, 19, and 20 dependent on Claim 15, overcome the rejection 
under 35 U.S.C. § 102(e) as being dependent on an allowable base Claim. 

2. Whether Claims 17 and 18 are rejected under 35 U.S.C. §103(a) as being obvious over 
Fox in view of Burrows. 

Applicants respectfully submit that the combination of Fox and Burrows does not 
satisfy the requirements of a prima facie case of obviousness because the combination of Fox 
and Burrows fails to suggest the present invention as claimed. In order to establish a prima 
facie case of obviousness, the prior art must suggest the desirability of the claimed invention 
(MPEP2142). 
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Additionally, "As reiterated by the Supreme Court in KSR 9 the framework for the 
objective analysis for determining obviousness under 35 U.S.C. 103 is stated in Graham v. 
John Deere Co., 383 U.S. 1, 148 USPQ 459 (1966). Obviousness is a question of law based 
on underlying factual inquiries" including "[ascertaining the differences between the 
claimed invention and the prior art" (MPEP 2141(11)). "In determining the differences 
between the prior art and the claims, the question under 35 U.S.C. 103 is not whether the 
differences themselves would have been obvious, but whether the claimed invention as a 
whole would have been obvious" (emphasis in original; MPEP 2141 .02(1)). Applicants note 
that "[t]he prior art reference (or references when combined) need not teach or suggest all the 
claim limitations. However, Office personnel must explain why the differenced between 
the prior art and the claimed invention would have been obvious to one of ordinary skill in 
the art " (emphasis added; MPEP 2141(111)). 

Appellant respectfully points out that independent Claim 15 recites "a computer usable 
storage medium having computer readable program code embodied therein for causing a 
computer system to implement security indication spanning tree instructions comprising: 

a device examination module for examining information regarding devices included 
in a centralized resource network , wherein said examining includes ascertaining what 
applications said devices support; 

an importance indication module for obtaining an indication of a relative importance 
of functionality provided by said device; and 
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a spanning tree module for building a spanning tree topology representation including 
said indication of said relative importance of said device in supporting said applications 



(emphasis added)." 



Appellant respectfully submits for the rationale stated herein in response to the present 
Office Action's 35 U.S. C.§ 102(e) rejection of Claim 1 that similar Claim 15 does not disclose 
"including said indication of said relative importance of said device in supporting said 
applications". Furthermore, Appellant respectfully submits that the present Office Action fails 
to explain why the difference(s) between the Fox and the features of Appellant's Claim 15 
would have been obvious to one of ordinary skill in the art. Thus, Appellant respectfully asserts 
that Claims 17 and 18 depending on Claim 15 are patentable as being dependent on an 
allowable base Claim. 

Additionally, Appellant respectfully submits that the teachings of Fox in view of 
Burrows are not sufficient to render Claims 17 and 18 prima facie obvious because there is 
no suggestion or motivation to make the proposed modification. "If the proposed 
modification would render the prior art invention being modified unsatisfactory for its 
intended purpose, then there is no suggestion or motivation to make the proposed 
modification." In re Gordon , 733 F.2d 900, 221 USPQ 1125 (Fed. Cir. 1984). 

Appellant respectfully submits that there is no suggestion or motivation to modify 
Fox with the teachings of Burrows because proposed modification would render Fox 
unsuitable for its intended purpose , and therefore the teachings of Fox and Burrows are not 
sufficient to render Claims 17 and 18 prima facie obvious. Appellant understands Burrows 
to disclose a packet traffic monitor which mitigates undesirable behavior patterns by 
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instructing as many switches in the network as possible to stop forwarding these broadcast 
packets . On the other hand, Appellant understands the intended purpose of Fox is to monitor 
the vulnerability posture of a network and its individual nodes; the vulnerability posture is 
based in part on each node's exposure to other network elements. 

Fox's 'vulnerability posture' involves fuzzy logic processing, which itself utilizes in 
part dynamic information as per a node's exposure to its environment . Burrow's discloses a 
method which would block a node's exposure to its environment , thereby interrupting and 
distorting Fox's vulnerability posture calculations . Thus, the teachings of Fox and Burrows 
are not sufficient to render the features of Claims 17 and 18 prima facie obvious since the 
proposed modification of Fox in view of Burrows would render Fox unsuitable for its 
intended purpose . 

In view of the combination of Fox and Burrows not satisfying the requirements of a 
prima facie case of obviousness, Appellant respectfully submits that Claims 17 and 18 
overcome the rejection under 35 U.S.C. §103(a), and that Claims 17 and 18 are thus in a 
condition for allowance. 
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Conclusion 



Appellant believes that pending Claims 1-20 are directed toward patentable subject 
matter. As such, Appellant respectfully requests that the rejections of Claims 1-20 be 
reversed. 



The Appellant wishes to encourage the Examiner or a member of the Board of 
Patent Appeals to telephone the Appellant's undersigned representative if it is felt that a 
telephone conference could expedite prosecution 



Respectfully submitted, 
WAGNER BLECHER LLP 



Dated: 4/8/2008 /John P. Wagner, Jr./ 

John P. Wagner, Jr. 

Registration No. 35,398 



Wagner Blecher LLP 
123 Westridge Drive 
Watsonville, CA 95076 
(408) 377-0500 
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VIII. Appendix - Clean Copy of Claims on Appeal 



1 . A security indication spanning tree method comprising: 
determining asset value of a network node; 
ascertaining exposure rating of said network node; 

establishing a functional priority risk indicator for indicating the likelihood of an 
attack from another network node; and 

creating a spanning tree schematic of a network including said network node, wherein 
said spanning tree schematic includes an indication of said asset value. 

2. A security indication spanning tree method of Claim 1 wherein said spanning tree 
schematic includes an indication of said exposure rating. 

3. A security indication spanning tree method of Claim 1 wherein said spanning tree 
schematic includes an indication of said attack risk. 

4. A security indication spanning tree method of Claim 1 wherein said asset value 
provides an indication of an economic value of functions provided by said network node. 

5. A security indication spanning tree method of Claim 1 said asset value corresponds to 
an economic impact of a disruption to functionality provided by said network node. 

6. A security indication spanning tree method of Claim 1 wherein said exposure rating 
defines a threshold value corresponding to connectivity of the network node with other 
network nodes. 
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7. A security indication spanning tree method of Claim 1 wherein said network node is 
given an exposure rating value based upon a connectivity distance from a root node. 

8. A security indication spanning tree method of Claim 1 wherein said root node is a 
node closest to an external network. 

9. A security indication spanning tree method of Claim 1 wherein said functional 
priority risk indicator is associated with an economic benefit and utility of functionality said 
network node provides. 

10. A security indication spanning tree system comprising: 
a bus for communicating information; 

a processor coupled to said bus, said processor for processing said information 
including instructions for building an attack impact susceptibility spanning tree 
representation including asset value factors; and 

a memory coupled to said bus, said memory for storing said information, including 
instructions for building said attack impact susceptibility spanning tree representation 
including said asset value factors. 

11. A security indication spanning tree system of claim 1 0 wherein said asset risk value is 
automatically determined.. 

12. A security indication spanning tree system of claim 10 further comprising a central 
console for interfacing with a network application management platform. 
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13. A security indication spanning tree system of claim 10 wherein said instructions 
include attack spread risk determination instructions. 

14. A security indication spanning tree system of claim 10 wherein said instructions 
include exposure rating determination directions. 

15. A computer usable storage medium having computer readable program code 
embodied therein for causing a computer system to implement security indication spanning 
tree instructions comprising: 

a device examination module for examining information regarding devices included 
in a centralized resource network , wherein said examining includes ascertaining what 
applications said devices support; 

an importance indication module for obtaining an indication of a relative importance 
of functionality provided by said device; and 

a spanning tree module for building a spanning tree topology representation including 
said indication of said relative importance of said device in supporting said applications. 

16. A computer usable storage medium of Claim 15 herein said relative importance of 
said device is based upon an economic value of functions said devices performs in support of 
said applications. 

17. A computer usable storage medium of Claim 15 further comprising an internal attack 
permeability module for investigating the permeability of a network in permitting an internal 
attack on a device from other devices included in the network. 
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18. A computer usable storage medium of Claim 17 wherein said investigating includes: 
analyzing the ease of attack on said device from other devices in said centralized 

resource network; and 

assigning an connectivity threshold value to said device based upon said analysis of 
said ease of attack. 

19. A computer usable storage medium of Claim 15 further comprising an attack danger 
assessment module for assessing the danger of an attack from other devices included in said 
network. 

20. A computer usable storage medium of Claim 19 further comprising: 
deriving an attack danger indication based upon said indication of said relative 

importance of said device and said connectivity threshold value; and associating said attack 
danger indication with said device. 
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IX. Evidence Appendix 
No evidence is herein appended. 
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X. Related Proceedings Appendix 
No related proceedings. 
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